kgo

7 ms·

31.
by kgo 14y ago
We're basically on the same page, but coming from different directions. Once you start having people import lists of trusted X.509 signatures from other trusted sources (e.g. 37 Signals) what you end up doing is basically creating the Web O
32.
by kgo 14y ago
Point taken, but my day-job rails project, which isn't even that big, has 461 gems in my Gemfile.lock. (which lists all the explicitly included gems, as well as their dependencies, if you're not familiar.) That is a lot of self-signed cert
33.
by kgo 14y ago
My proposal was that rubygems would create a simulated certificate authority that operates similarly to the PGP Global Directory, which would allow registered users to have their keys signed by an authorized RubyGems.org signing key. (This
34.
by kgo 14y ago
You don't want to send an actual exploit in clear text to a possibly compromised email account. PGP encrypts, and provides some level of validation that the message can only be read by someone on the security team.
35.
by kgo 14y ago
The trouble is self-signed X.509 certificates are pretty worthless. X.509 certs are built around the concept that they're issued by a trusted provider. I tried to get together a proposal to introduce OpenPGP signed gems and wrote some proo
36.
by kgo 14y ago
I wrote a similar thing a while ago for python: http://www.grant-olson.net/python/pyasm It even mapped all the exported symbols from the python API so you could do stuff like: CALL PySys_WriteStdout "Hello, World!\n\0" About ever
37.
by kgo 14y ago
In the particular example of a cab driver... There are plenty of other reasons you might have kids but not a wife. Maybe you're a widower. Maybe they're actually your brother's kids, but he and his wife were killed by a drunk driver, and
38.
by kgo 14y ago
There's a lot in that thread to sort through, but... The exchange that zhou founded had about 60,000 bitcoins stolen in two instances. Plenty of evidence pointed to an inside job, probably by zhou himself. This link provides Zhou's explana
39.
by kgo 15y ago
If you look at this as an uptime issue, it has the same answer as any other uptime issue. Redundancy. A single server isn't good for uptime because when it dies you're screwed. At the next level, a single data-center only gives you so muc
40.
by kgo 15y ago
I know this is tangential to your main point but I actually like and expect some bitching when I'm interviewing someone, and frankly don't see how you could do an honest interview without some bitching. The supposed motivation for the no-b
41.
by kgo 15y ago
Megacorp decides to purchase KFC. As part of due diligence, they want to know what the secret recipe is. After all, you'd hate to find out one of the special herbs and spices is cocaine or arsenic. This is fine because MegaCorp signed an
42.
by kgo 15y ago
I made nachos for my niece once. Put Doritos on a cookie sheet, smothered them in cheese, and put them in the broiler. She thought they were weird and broken because I didn't use the normal plain-style tortilla chips. Her mom made her a
43.
by kgo 15y ago
Heh, I worked in big oil at the time, and they couldn't kill blaster because IT people kept on imaging new computers on internally exposed networks. We probably could have killed the outbreak a week or two earlier if everyone just stopped
44.
by kgo 15y ago
I believe the LED that tells you your MacBook's camera is on is hard-wired into the motherboard, for the very purpose of making it impossible to covertly enable the camera via software. A similar approach could be used for a mic.
45.
by kgo 15y ago
In my area, you're on Comcast if you're pissed off at Verizon, and you're on Verizon if you're pissed off at Comcast. I'm on Comcast because I was a Verizon early adopter, with DSL in the 90s. It got to the point where even their cheapest
46.
by kgo 15y ago
"You don't have to follow this exact formula but the basic idea is that you set up "stripes" of seniority, where the top stripe took the most risk and the bottom stripe took the least, and each "stripe" shares an equal number of shares, whi
47.
by kgo 15y ago
I saw a presentation at RailsConf two years ago where they took it to the next level. It was the Spanish Internet Party. If they got members in parlament, you could actually vote yourself online, and the MP would just vote based on the co
48.
by kgo 15y ago
I explicitly acknowledge the difference between scarce and non-scare goods in the above post if you could bother to read the second paragraph. The part you're leaving out in your 'improved' anology is that it might cost 10 years and ten mi
49.
by kgo 15y ago
Apply this same argument to someone who spends hundreds of hours working so that they can buy a car. This is all done out of self interest. Most people would not conclude that it's okay for someone that a car thief, who steals the car bec
50.
by kgo 15y ago
As usual it depends. At the risk of spouting a cliche, there are no silver bullets. The best way to get a team working is to analyze and enumerate the current problems and shortcomings, and find a way to reduce or eliminate them. Is the pr
51.
by kgo 15y ago
If it's the first thing you've installed from macPorts, there are probably downloading and compiling a billion dependencies.
52.
by kgo 15y ago
FWIW, bingbot basically DDOS'ed our site a few months ago by crawling links that were labeled nofollow/noindex in the hrefs. Adding a rule to robots.txt fixed the problem.
53.
by kgo 15y ago
By this argument wouldn't defamation and libel also be legal?
54.
by kgo 15y ago
Actually it works the other way around, and is considered to be a problem by many security experts. If you don't have a Hidden OS partition, and the court requests the password, it's impossible for you to prove you DON'T have one. Just li
55.
by kgo 15y ago
I'm just curious why someone who did this is still a fellow at a center for ethics . It seems like the whole situation, even if it's been cleared up with MIT and JSTOR, is completely unethical, regardless of the legal case. Is the positio
56.
by kgo 15y ago
I had this crazy idea that I'd buy a vanity domain with my name in it. Use it as my personal email, which is used an all kinds of technical newsgroups. Setup a web page where I described myself, linked to various projects, source code, et
57.
by kgo 15y ago
HushMail has a java based browser that's supposed to be all client side, but last time I tried hush, they generated keys that were incompatible with GPG2. But yeah, like you said, if you're only checking emails on machines that are secure a
58.
by kgo 15y ago
He did say in the past 20 years. Everything you're talking about occurred outside of that time frame.
59.
by kgo 15y ago
100,000 might as well be 20 bucks to a fund manager who has some high-risk fun-money set aside, or to some dot-com billionaire who thinks the crypto aspects are neat. I really hope this is the case with the insanely large buys, and it's not
60.
by kgo 15y ago
At the time this happened bitcoins were trading for less than 10 cents. But I have seen six-figure deals go by on the ticker at #bitcoin-market. Thirty day volume over at mtgox is 6 million dollars. Granted, much of this might really same

More ›